Skip to content
ClamUI
Docs
Open source · MIT · GTK4 / libadwaita

Antivirus, native to your Linux desktop.

ClamUI is a modern graphical front-end for ClamAV. Real scan profiles, a hash-verified quarantine, and a system security audit - packaged like a proper GTK4/libadwaita desktop app.

Install ClamUI Star on GitHub
Flatpak · .deb · AppImage · Source
Engine
Host ClamAV
Runtime
Python 3.11+
License
MIT
ClamUI showing a completed scan with one detected threat

Native to GNOME

Built with GTK4 + libadwaita for a GNOME-style Linux desktop experience - not a repackaged Electron web app.

Privacy by default

No product analytics, crash reporting, or metrics. VirusTotal is opt-in; keys use the system keyring by default.

Deep security toolbox

Beyond AV: layered system audits, scheduled scans, optional on-access scanning, and ClamAV configuration.

Open source, honest

MIT-licensed. Built in the open on GitHub. Contributions and issues welcome; no enterprise upsell behind the next click.

A guided tour

What's inside

The practical security tools that make ClamAV feel at home on your desktop.

Flagship

System security audit

Go beyond virus scanning. Tier 1 checks ClamAV health, firewall, MAC enforcement, SSH hardening, and more; opt-in Tier 2 deep scans run Lynis and chkrootkit with authorization.

  • Tier 1 posture checks without root
  • Firewall, MAC, and SSH hardening review
  • Opt-in Tier 2 Lynis and rootkit checks
ClamUI system security audit view
Reusable

Scan profiles & entry points

Save the scans you actually run, launch them from supported file-manager menus, or opt in to scanning newly mounted removable media.

  • Targets + exclusion globs per profile
  • Nautilus, Dolphin, and Nemo integration
  • Opt-in scans for removable devices
ClamUI profile management view
Threat handling

Quarantine, verified

Infected files are moved with restrictive permissions and SHA-256 hashed. Restore only if integrity checks pass - no silent tampering.

  • SHA-256 integrity verification
  • SQLite-backed metadata ledger
  • Secure restore + hard delete
ClamUI quarantine management view
Visibility

History & statistics

Paginated scan history with full result dumps, plus a dashboard of what's been caught, when, and where - so you're never guessing.

  • Per-scan detail with exportable CSV
  • Threat category breakdown
  • Pagination tuned for years of logs
ClamUI scan history view
Preferences

Configured, not configurable-to-death

Modular preferences pages surface the ClamAV settings that actually matter - freshclam, on-access (clamonacc), scheduled scans, VirusTotal - without dumping the full clamd.conf on you.

  • Auto-detects ClamAV daemon & config paths
  • Safe permission elevation to apply changes
  • Scheduled scans via systemd timers or cron
ClamUI configuration view
Optional

VirusTotal, when you want it

Enrich detections with a second opinion. API keys use the system keyring by default; a plaintext fallback requires explicit opt-in when the keyring is unavailable.

  • Keyring-backed API key storage by default
  • SHA-256 lookups + optional uploads
  • Rate-limit aware with retry/backoff
ClamUI components view
Honest answers

Why antivirus on Linux?

The most common comment about desktop AV on Linux is that it's unnecessary. That's half true - and the other half is where ClamUI earns its place.

01

Do I even need antivirus on Linux?

Desktop Linux malware is rare - but files don't stop at your laptop. If you share documents with Windows or macOS users, run a mail server, use Wine, mount network shares, or pull third-party installers, you're a vector whether or not you're a victim. ClamUI catches infected files before you forward them on.

02

Isn't ClamAV just a server tool?

ClamAV is an excellent engine available from many distros, but it's historically been CLI-first. ClamUI is a desktop interface around it: progress, profiles, quarantine, scheduled scans, and file-manager integration - with none of the engine hidden from you.

03

Does this talk to the cloud?

Scanning, quarantine, and audit run locally. freshclam contacts official ClamAV mirrors to update signatures, and VirusTotal requests occur only when you opt in to that integration.

04

How does this differ from another GUI I tried?

Three things: a system security audit beyond virus scanning, a SHA-256-verified quarantine with a proper restore path, and a GTK4/libadwaita Linux desktop interface. It's designed as a Linux desktop app first, not a Windows AV port.

Get it running

Install

All formats use host ClamAV and do not bundle its engine or database. Install host clamscan and freshclam first; daemon mode also needs clamd and clamdscan.

Sandboxed UI that calls host ClamAV through flatpak-spawn --host. On supported Debian-family hosts, host-setting saves use a version-matched trusted helper.

flatpak install flathub io.github.linx_systems.ClamUI
flatpak run io.github.linx_systems.ClamUI
Releases · .deb · AppImage Installation guide Signing policy
Verify release artifacts
Follow the current artifact-specific signing instructions before installing.

.deb Debian / Ubuntu - package signature

Verify both packages with the pinned ClamUI signing-key fingerprint. Treat any dpkg-sig error or non- GOODSIG result as a failed verification.

AppImage Embedded signature

Tagged AppImage releases can include an embedded signature. Follow the signing policy to inspect it and validate the expected signing key.

Flatpak validates Flathub repository signatures during installation. For release downloads and source tags, follow the signing policy.